Troubleshooting: LDAPMembershipProvider.GetUser Exception - Index Was Out of Range

Version Affected: All
 
 

Overview

Users are unable to sign in against an LDAP-backed Datastore and receive an invalid_user error. The SecureAuth Identity Platform error log shows an exception similar to: LDAPMembershipProvider.GetUser: Exception: Index was out of range. Must be non-negative and less than the size of the collection.

Cause

The Lightweight Directory Access Protocol (LDAP) search filter configured on the Datastore is matching more than one object in the directory for the same lookup value — for example, both a user account and a contact object that share the same email address or username attribute.

The GetUser call this error comes from requires the search filter to resolve to exactly one object. If the filter matches more than one object in the directory, there is no single result to return and the call throws this exact error.

Resolution:

Edit the Datastore's search filter so it can only ever match a single object class, rather than any object type that happens to share the lookup attribute. For example, change a filter such as (&(mail=%v)(objectclass=*)) to (&(mail=%v)(objectclass=user)), replacing user with whichever object class correctly and uniquely identifies your directory's user accounts.

Use the Active Directory Users and Computers console's Custom Search > Advanced tab to run the LDAP query directly and confirm how many objects it matches before saving the change. The screenshot below shows a custom LDAP query returning two objects for the same search value — one Contact object and one User object — which is exactly the kind of multiple-match result that causes this error.

Confirm against your directory that the narrowed filter still returns the correct user and that it now resolves to exactly one object. Any filter that can match more than one object in the directory causes this error, regardless of which attribute is used for the lookup.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.